Add -i flag for case-insensitive matching so typing 'o' filters to OK.
Remove -only-match and hidden inputbar which broke keyboard selection.

Switch from --netfilter to --iptables mode so Jool only processes
container traffic. --netfilter mode intercepts all packets to
64:ff9b::/96, breaking upstream NAT64 (e.g., Android hotspot tethering).

Show OK/Cancel/Clear cache options instead of confusing menu.
Add -only-match to prevent typing from breaking selection.

Uses NixOS services.radicle module with clan vars for key management.
Configures SOCKS proxy for .onion seed connectivity.

- Cache PIN in kernel keyring (keyctl) for 5 minutes with sliding window
- Show menu to use cached PIN or clear cache when cache exists
- Escape <, >, & in SSH args for pango markup (fixes empty prompt with
commands containing redirections like 2>/dev/null)